fix: [Bug]: Vulnerability found in moby (CVE-2026-34040) (closes #3614)#3648
fix: [Bug]: Vulnerability found in moby (CVE-2026-34040) (closes #3614)#3648deadanon wants to merge 1 commit intotestcontainers:mainfrom
Conversation
✅ Deploy Preview for testcontainers-go ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
Summary by CodeRabbit
WalkthroughBumped three indirect Moby-related dependencies across 60 Changes
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~3 minutes Possibly related PRs
Suggested labels
Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
examples/nginx/go.mod (1)
39-41: Upgrade moby dependencies to versions that include the CVE-2026-34040 fix, or document the security acceptance.The pinned pseudo-versions (github.com/moby/go-archive v0.2.1-0.20260403184245-..., github.com/moby/moby/api v1.54.2-0.20260407083204-..., and github.com/moby/moby/client v0.4.1-0.20260407083204-...) do not contain the upstream fix for CVE-2026-34040, which is in Moby 29.3.1+ daemon code. Go vulnerability scanners (Trivy, govulncheck) treat these versions as vulnerable until the api/client modules are released at or above versions containing the fix. Either upgrade to remediated versions or explicitly document why this security risk is accepted in your environment.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@examples/nginx/go.mod` around lines 39 - 41, The pinned moby pseudo-versions for github.com/moby/go-archive, github.com/moby/moby/api, and github.com/moby/moby/client are treated as vulnerable for CVE-2026-34040; update those module requirements to released versions that include the Moby 29.3.1+ fix (or later) so scanners stop flagging them, or add an explicit security acceptance note documenting risk and justification (e.g., in a SECURITY.md) referencing these modules; edit the go.mod entries for github.com/moby/go-archive, github.com/moby/moby/api, and github.com/moby/moby/client to point to remediated semver tags or add a clear documented exception.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Nitpick comments:
In `@examples/nginx/go.mod`:
- Around line 39-41: The pinned moby pseudo-versions for
github.com/moby/go-archive, github.com/moby/moby/api, and
github.com/moby/moby/client are treated as vulnerable for CVE-2026-34040; update
those module requirements to released versions that include the Moby 29.3.1+ fix
(or later) so scanners stop flagging them, or add an explicit security
acceptance note documenting risk and justification (e.g., in a SECURITY.md)
referencing these modules; edit the go.mod entries for
github.com/moby/go-archive, github.com/moby/moby/api, and
github.com/moby/moby/client to point to remediated semver tags or add a clear
documented exception.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 03ef2e65-2d83-43fe-8f15-f9b6828de2f2
⛔ Files ignored due to path filters (66)
examples/nginx/go.sumis excluded by!**/*.sumgo.sumis excluded by!**/*.summodules/aerospike/go.sumis excluded by!**/*.summodules/arangodb/go.sumis excluded by!**/*.summodules/artemis/go.sumis excluded by!**/*.summodules/azure/go.sumis excluded by!**/*.summodules/azurite/go.sumis excluded by!**/*.summodules/cassandra/go.sumis excluded by!**/*.summodules/chroma/go.sumis excluded by!**/*.summodules/clickhouse/go.sumis excluded by!**/*.summodules/cockroachdb/go.sumis excluded by!**/*.summodules/compose/go.sumis excluded by!**/*.summodules/consul/go.sumis excluded by!**/*.summodules/couchbase/go.sumis excluded by!**/*.summodules/databend/go.sumis excluded by!**/*.summodules/dind/go.sumis excluded by!**/*.summodules/dockermcpgateway/go.sumis excluded by!**/*.summodules/dockermodelrunner/go.sumis excluded by!**/*.summodules/dolt/go.sumis excluded by!**/*.summodules/dynamodb/go.sumis excluded by!**/*.summodules/elasticsearch/go.sumis excluded by!**/*.summodules/etcd/go.sumis excluded by!**/*.summodules/forgejo/go.sumis excluded by!**/*.summodules/gcloud/go.sumis excluded by!**/*.summodules/grafana-lgtm/go.sumis excluded by!**/*.summodules/inbucket/go.sumis excluded by!**/*.summodules/influxdb/go.sumis excluded by!**/*.summodules/k3s/go.sumis excluded by!**/*.summodules/k6/go.sumis excluded by!**/*.summodules/kafka/go.sumis excluded by!**/*.summodules/localstack/go.sumis excluded by!**/*.summodules/mariadb/go.sumis excluded by!**/*.summodules/meilisearch/go.sumis excluded by!**/*.summodules/memcached/go.sumis excluded by!**/*.summodules/milvus/go.sumis excluded by!**/*.summodules/minio/go.sumis excluded by!**/*.summodules/mockserver/go.sumis excluded by!**/*.summodules/mongodb/go.sumis excluded by!**/*.summodules/mssql/go.sumis excluded by!**/*.summodules/mysql/go.sumis excluded by!**/*.summodules/nats/go.sumis excluded by!**/*.summodules/nebulagraph/go.sumis excluded by!**/*.summodules/neo4j/go.sumis excluded by!**/*.summodules/ollama/go.sumis excluded by!**/*.summodules/openfga/go.sumis excluded by!**/*.summodules/openldap/go.sumis excluded by!**/*.summodules/opensearch/go.sumis excluded by!**/*.summodules/pinecone/go.sumis excluded by!**/*.summodules/postgres/go.sumis excluded by!**/*.summodules/pulsar/go.sumis excluded by!**/*.summodules/qdrant/go.sumis excluded by!**/*.summodules/rabbitmq/go.sumis excluded by!**/*.summodules/redis/go.sumis excluded by!**/*.summodules/redpanda/go.sumis excluded by!**/*.summodules/registry/go.sumis excluded by!**/*.summodules/scylladb/go.sumis excluded by!**/*.summodules/socat/go.sumis excluded by!**/*.summodules/solace/go.sumis excluded by!**/*.summodules/surrealdb/go.sumis excluded by!**/*.summodules/tidb/go.sumis excluded by!**/*.summodules/toxiproxy/go.sumis excluded by!**/*.summodules/valkey/go.sumis excluded by!**/*.summodules/vault/go.sumis excluded by!**/*.summodules/vearch/go.sumis excluded by!**/*.summodules/weaviate/go.sumis excluded by!**/*.summodules/yugabytedb/go.sumis excluded by!**/*.sum
📒 Files selected for processing (66)
examples/nginx/go.modgo.modmodules/aerospike/go.modmodules/arangodb/go.modmodules/artemis/go.modmodules/azure/go.modmodules/azurite/go.modmodules/cassandra/go.modmodules/chroma/go.modmodules/clickhouse/go.modmodules/cockroachdb/go.modmodules/compose/go.modmodules/consul/go.modmodules/couchbase/go.modmodules/databend/go.modmodules/dind/go.modmodules/dockermcpgateway/go.modmodules/dockermodelrunner/go.modmodules/dolt/go.modmodules/dynamodb/go.modmodules/elasticsearch/go.modmodules/etcd/go.modmodules/forgejo/go.modmodules/gcloud/go.modmodules/grafana-lgtm/go.modmodules/inbucket/go.modmodules/influxdb/go.modmodules/k3s/go.modmodules/k6/go.modmodules/kafka/go.modmodules/localstack/go.modmodules/mariadb/go.modmodules/meilisearch/go.modmodules/memcached/go.modmodules/milvus/go.modmodules/minio/go.modmodules/mockserver/go.modmodules/mongodb/go.modmodules/mssql/go.modmodules/mysql/go.modmodules/nats/go.modmodules/nebulagraph/go.modmodules/neo4j/go.modmodules/ollama/go.modmodules/openfga/go.modmodules/openldap/go.modmodules/opensearch/go.modmodules/pinecone/go.modmodules/postgres/go.modmodules/pulsar/go.modmodules/qdrant/go.modmodules/rabbitmq/go.modmodules/redis/go.modmodules/redpanda/go.modmodules/registry/go.modmodules/scylladb/go.modmodules/socat/go.modmodules/solace/go.modmodules/surrealdb/go.modmodules/tidb/go.modmodules/toxiproxy/go.modmodules/valkey/go.modmodules/vault/go.modmodules/vearch/go.modmodules/weaviate/go.modmodules/yugabytedb/go.mod
| github.com/moby/go-archive v0.2.1-0.20260403184245-7cea6367da40 // indirect | ||
| github.com/moby/moby/api v1.54.2-0.20260407083204-daa0cb7f2359 // indirect | ||
| github.com/moby/moby/client v0.4.1-0.20260407083204-daa0cb7f2359 // indirect |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== Find remaining vulnerable pins in all go.mod files =="
rg -n --glob '**/go.mod' \
'github\.com/moby/go-archive v0\.2\.0|github\.com/moby/moby/api v1\.54\.1|github\.com/moby/moby/client v0\.4\.0' \
|| true
echo
echo "== Count modules already bumped to expected versions =="
rg -n --glob '**/go.mod' 'github\.com/moby/go-archive v0\.2\.1-0\.20260403184245-7cea6367da40' | wc -l
rg -n --glob '**/go.mod' 'github\.com/moby/moby/api v1\.54\.2-0\.20260407083204-daa0cb7f2359' | wc -l
rg -n --glob '**/go.mod' 'github\.com/moby/moby/client v0\.4\.1-0\.20260407083204-daa0cb7f2359' | wc -lRepository: testcontainers/testcontainers-go
Length of output: 198
🌐 Web query:
`Check whether CVE-2026-34040 (or its GHSA/GO alias) marks these exact versions as fixed:
- github.com/moby/go-archive v0.2.1-0.20260403184245-7cea6367da40
- github.com/moby/moby/api v1.54.2-0.20260407083204-daa0cb7f2359
- github.com/moby/moby/client v0.4.1-0.20260407083204-daa0cb7f2359
Please include the advisory page(s) and fixed-version ranges.`
💡 Result:
No, CVE-2026-34040 (GHSA-x744-4wpc-v9h2) does not mark the specified versions as fixed. The advisory and NVD state the vulnerability affects Moby/Docker Engine versions prior to 29.3.1, patched in 29.3.1. Fixed version range: >= 29.3.1. The queried versions are pseudo-versions from April 2026 (post-fix release on 2026-03-25), but the advisory does not explicitly list or reference these specific module versions (github.com/moby/go-archive v0.2.1-0.20260403184245-7cea6367da40, github.com/moby/moby/api v1.54.2-0.20260407083204-daa0cb7f2359, github.com/moby/moby/client v0.4.1-0.20260407083204-daa0cb7f2359) as fixed. Vulnerability is in the core Moby daemon (docker-v29.3.1), not explicitly tied to these submodules. Advisory pages: - GHSA-x744-4wpc-v9h2 (primary GHSA) - https://nvd.nist.gov/vuln/detail/CVE-2026-34040 - https://github.com/moby/moby/releases/tag/docker-v29.3.1 (release notes confirming fix)
Citations:
- 1: https://nvd.nist.gov/vuln/detail/CVE-2026-34040
- 2: https://nvd.nist.gov/vuln/detail/cve-2026-34040
- 3: GHSA-x744-4wpc-v9h2
- 4: https://osv.dev/vulnerability/GHSA-x744-4wpc-v9h2
- 5: GHSA-x744-4wpc-v9h2
- 6: v29.3.1 moby/moby#52229
- 7: https://newreleases.io/project/github/moby/moby/release/docker-v29.3.1
Confirm scanner recognition of pseudo-versions as fixed for CVE-2026-34040.
Verification confirms that vulnerable pins (v0.2.0, v1.54.1, v0.4.0) are completely removed across all 66 modules, and all dependencies have been uniformly bumped to the post-fix versions. The pseudo-versions are dated 2026-04-07, after the CVE fix release (docker-v29.3.1, 2026-03-25).
However, CVE-2026-34040 advisories do not explicitly enumerate these specific pseudo-versions as fixed. Please confirm that your scanning tool (OSV/advisory database) recognizes these post-fix pseudo-versions as patched, especially if your CI gates on strict version-match semantics.
1 participant
Closes #3614
Summary: Testcontainers-go depends on github.com/moby/go-archive v0.2.0, github.com/moby/moby/api v1.54.1, and github.com/moby/moby/client v0.4.0, which are flagged by CVE-2026-34040 vulnerability scanners as containing a security vulnerability in moby packages.
Root cause: The root go.mod and all 65+ module go.mod files pin moby dependencies (go-archive v0.2.0, moby/api v1.54.1, moby/client v0.4.0) at versions affected by CVE-2026-34040. The go-archive package is directly used in container.go:256 for TarWithOptions when building Docker contexts, and moby/client is used throughout docker.go and other core files for Docker Engine API communication. No patched upstream release is currently available in the Go module proxy.
Approach: Bump all moby dependencies (go-archive, moby/api, moby/client, and any transitive moby/* packages) to patched versions once they are released upstream, then run go mod tidy across the root module and all 66 submodules. The project already has Dependabot configured for monthly go module updates and a Makefile tidy-all target to propagate changes. If the upstream fix is delayed, evaluate whether the vulnerable code path (archive tar handling in container.go or Docker client calls) can be mitigated with input validation or restricted usage.
Automated fix by BugBot